Threats affecting pkg:generic/net-snmp

A denial-of-service vulnerability in UAA's private_key_jwt client-authentication mechanism allows an attacker with write access to clients or a compromised endpoint to cause service unavailability. This occurs by triggering repeated parsing of large cached JSON Web Key Set (JWKS) objects, leading to excessive CPU usage and potential Java heap exhaustion resulting in OutOfMemoryError.

CVE-2026-59385 describes a vulnerability where a user with SpaceDeveloper privileges can modify the URL of a space-scoped broker without changing its credentials. This allows the user to indirectly extract existing broker credentials by redirecting them to a broker they control. The Cloud Foundry API does not allow direct reading of broker credentials, so this method bypasses that restriction. The vulnerability has a low severity score of 2.7 and does not impact integrity or availability.

Cloud Controller (CAPI) has multiple instances where sensitive data is leaked into audit logs. Specifically, credentials for custom buildpacks appear in audit events related to app manifest application, creation, and updates. Additionally, syslog drain URL credentials are exposed in user-provided service instance audit events, and service binding parameters are leaked in app manifest and service binding audit events. This exposure could lead to unauthorized access to sensitive credentials if audit logs are accessed by unauthorized parties.

Apache Fineract versions up to and including 1.15.0 are vulnerable to a time-based blind SQL injection via the Center read endpoint and datatable entry read endpoints. The vulnerability arises because user-supplied ordering parameters are concatenated directly into the SQL ORDER BY clause, bypassing existing regex validation. This flaw allows any authenticated user with read access to exploit the injection. Upgrading to version 1.16.1 addresses this issue.

CVE-2026-59386 is a vulnerability where a SpaceSupporter can improperly modify an application's start command and buildpack, actions normally restricted to SpaceDeveloper privileges. This privilege escalation allows unauthorized retrieval of service credentials by leveraging malicious start commands or custom buildpacks.

A misconfiguration in the Nginx routing for Cloud Controller allows unauthenticated access to certain staging callback endpoints under /internal/v3/. This permits attackers with a valid build or droplet GUID to submit forged staging callbacks, transition droplets to a STAGED state, and persist arbitrary metadata without proper authorization. The issue enables privilege escalation beyond intended role boundaries due to insufficient access controls on these endpoints.

A SQL Injection vulnerability exists in Apache Fineract through version 1.15.0. It affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint due to improper neutralization of special elements in SQL commands. This allows attackers to inject malicious SQL code. The issue is fixed in version 1.16.1.

A vulnerability in GCC libstdc++ occurs when extracting data into a bitset from a wide-character stream, causing improper stack memory allocation related to character size and alignment. This flaw can lead to a stack-based buffer overflow, potentially resulting in a denial of service (DoS) if an attacker supplies crafted input. The vulnerability requires specific application behavior and is rated as medium severity with a CVSS score of 6.5. No patch or mitigation is currently available that meets Red Hat's criteria for ease of use and stability.

A vulnerability in gcc's libstdc++ library allows a denial of service (DoS) via the std::from_chars() function when processing a non-null-terminated string. This triggers an out-of-bounds read beyond the allocated buffer, potentially causing application crashes or invalid floating-point conversions. The issue is rated low severity due to the requirement for untrusted, non-null-terminated input and the limited impact confined to crashes or inaccurate parsing without memory corruption or code execution.

The Gravity Forms plugin for WordPress up to version 3.1.1 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping in certain fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. The issue arises because some fields allow raw HTML submissions that bypass sanitization and are later decoded into executable markup by the browser.

A vulnerability in the libstdc++ component of GCC allows an attacker to trigger an integer wrap by providing an excessively large element count to a std::vector<bool> constructor. This leads to an inconsistent container state and out-of-bounds memory access, causing application crashes or Denial of Service (DoS). Exploitation requires attacker-controlled near-maximum integer values during container initialization, limiting the practical exposure. No mitigation is currently available that meets Red Hat's criteria, and the vulnerability is rated moderate severity.

The Gravity Forms plugin for WordPress versions up to and including 3.1.2 contains a stored cross-site scripting (XSS) vulnerability via the List Field. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires an administrator to click a crafted link in the entry detail view and confirm a dialog, triggering execution of attacker-supplied JavaScript code.

The Formidable Forms WordPress plugin is vulnerable to arbitrary plugin installation via the 'file_url' parameter in versions up to and including 6.35. This vulnerability arises from insufficient validation of URL prefixes and improper permission checks that allow authenticated users with subscriber-level access or higher to install plugins without proper capabilities. Exploitation requires the site to be using the free version of the plugin (Formidable Pro is not installed).

A critical vulnerability exists in Teltonika Networks RUTOS devices (versions 7.22 through 7.24.2) and TSWOS devices (versions 1.9 through 1.10) that allows unauthenticated users to directly invoke LUA functions, bypassing normal API validation. This flaw can lead to operating system command execution due to improper request flow handling.

A vulnerability in GCC's libstdc++ parallel search implementation allows a local attacker to cause an out-of-bounds memory access due to an undersized internal buffer. This can lead to a denial of service (DoS) by crashing the affected process. Exploitation requires the application to be compiled with the optional parallel mode, which is not enabled by default.

A vulnerability in the Kroxylicious ACL authorizer's prefix-matching logic can cause authorization rules to be incorrectly applied or bypassed. This flaw may allow an authenticated Kafka client to access resources, such as reading a topic, that should be denied based on the ACL configuration.

The Food Store plugin for WordPress versions up to and including 1.5.5 contains a stored cross-site scripting (XSS) vulnerability via the 'service_time' parameter. This vulnerability arises due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Exploitation requires a specific non-default configuration where 'Enable Checkout Service Fields' is disabled while 'Enable Pickup/Delivery Service' remains enabled.

A flaw in Red Hat Enterprise Linux 9 kernel builds (RHEL 9.6 through 9.10) involves an incomplete backport of a previous fix, causing a local_bh imbalance in the seg6_input_core() function. This flaw can lead to softirq starvation and denial of service on systems configured with SRv6 tunnels. Upstream Linux kernels and RHEL 10 are not affected.

The Gravity Forms plugin for WordPress up to and including version 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of input type List. This occurs because the plugin uses WordPress' unrestricted maybe_unserialize() instead of its own hardened version, allowing unauthenticated attackers to inject PHP objects into post meta. While the plugin itself lacks a gadget chain, other plugins or themes may provide one, potentially enabling remote code execution. Specifically, if the custom field maps to the protected _wp_page_template meta key, WordPress functions can be leveraged to achieve remote code execution on vulnerable hosts.

The AI Engine WordPress plugin up to version 3.8.6 has a Missing Authorization vulnerability in its MCP module's OAuth 2.1 Dynamic Client Registration endpoint. This flaw allows unauthenticated users to register OAuth clients with attacker-controlled redirect URIs. If an administrator approves the malicious client on the OAuth consent screen, attackers can gain administrator-level control, including user creation and option updates. The consent page lacks protections against clickjacking, increasing the risk of unauthorized approval.